Open kares opened 3 years ago
The plugin sets the source_host field name, which should be updated to [host][name] in ECS mode.
source_host
[host][name]
Also, the plugin does not use the codec for decoding, the JSON codec might be a good fit to gain event.original as well as target support.
event.original
target
The plugin sets the
source_hostfield name, which should be updated to[host][name]in ECS mode.Also, the plugin does not use the codec for decoding, the JSON codec might be a good fit to gain
event.originalas well astargetsupport.